3 ms·
You can use plain HTTP for time sync. Almost all HTTP servers respond with a time header.
by creeble 2y ago
You can use plain HTTP for time sync. Almost all HTTP servers respond with a time header.
- jandrese 2y agoThe whole point of the exercise was to make it secure though. If you don't care about MITM attackers then NTP works great.
- numpad0 2y agoI don't get the supposed security aspect of getting false time. Hacker gives you 1980-01-01 or 4096-13-32 and mess up CRL and ruin your day...how. Years ago I've tried privilege escalation exploit to play with a phone and it involved rolling back date to unexpire signature, so I know there is exploit potential, but it... it just feels like RTC bootstrap problem should be something solvable.
- creeble 2y agoIsn't that a provably pointless exercise though? Security protocols (at least the ones in common use) require certificates or keys that eventually expire, because of the risk of a permanent key being compromised. If they expire, the protocol needs time. QED.